CVE-2026-19352
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was found in lossless-cut up to version 3.69.0, leading to server-side request forgery (SSRF) in an unknown functionality of the file src/main/httpServer.ts in the Built-in HTTP API Service component. The attack requires access to the local network and is characterized by high complexity. The exploit has been publicly disclosed.
Risk Assessment
SSRF vulnerability may allow an attacker to send requests to internal resources, potentially leading to confidentiality or integrity breaches. High complexity and requirement for local network access limit the risk.
Recommendation
It is recommended to apply the patch (commit 260802348955231442c4bae6c2d9d8ede947af0a) or update to a newer version. Also restrict API access to trusted networks only.
Original NVD description (English source)
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.